NUWA RESEARCH RECORD
Tensor Trust: Interpretable Prompt Injection Attacks from an Online Game
Original publication ↗ · BibTeX · RISThe study finds that apparently simple authorization instructions remain vulnerable and reports selected transfer demonstrations beyond the game.
Research question
How robust are instruction-following models against human-created prompt extraction and hijacking?
Design & assumptions
An online game supplies human attack/defense interactions; filtered subsets become separate extraction and hijacking benchmarks with explicit defense-validity checks.
Findings
The study finds that apparently simple authorization instructions remain vulnerable and reports selected transfer demonstrations beyond the game.
Limits & counterevidence
Adversarial filtering and reference-model selection shape the test population. Game success uses a narrow string criterion; it is not equivalent to real application compromise.
Source evidence
| System | Measure | Reported value | Conditions & location |
|---|---|---|---|
| gpt-3.5-turbo-0613 | Hijacking robustness rate | 18.4%% | Prompt hijacking benchmark / Hijacking#A3.T1; row gpt-3.5-turbo-0613; column Hijacking robustness rate; condition Hijacking |
| gpt-3.5-turbo-0613 | Defense validity | 89.2%% | Prompt hijacking benchmark / Hijacking#A3.T1; row gpt-3.5-turbo-0613; column Defense validity; condition Hijacking |
| claude-instant-1.2 | Hijacking robustness rate | 45.9%% | Prompt hijacking benchmark / Hijacking#A3.T1; row claude-instant-1.2; column Hijacking robustness rate; condition Hijacking |
| claude-instant-1.2 | Defense validity | 77.6%% | Prompt hijacking benchmark / Hijacking#A3.T1; row claude-instant-1.2; column Defense validity; condition Hijacking |
| chat-bison@001 | Hijacking robustness rate | 10.2%% | Prompt hijacking benchmark / Hijacking#A3.T1; row chat-bison@001; column Hijacking robustness rate; condition Hijacking |
| chat-bison@001 | Defense validity | 89.3%% | Prompt hijacking benchmark / Hijacking#A3.T1; row chat-bison@001; column Defense validity; condition Hijacking |
| gpt-4-0613 | Hijacking robustness rate | 84.3%% | Prompt hijacking benchmark / Hijacking#A3.T1; row gpt-4-0613; column Hijacking robustness rate; condition Hijacking |
| gpt-4-0613 | Defense validity | 81.7%% | Prompt hijacking benchmark / Hijacking#A3.T1; row gpt-4-0613; column Defense validity; condition Hijacking |
| claude-2.0 | Hijacking robustness rate | 53.1%% | Prompt hijacking benchmark / Hijacking#A3.T1; row claude-2.0; column Hijacking robustness rate; condition Hijacking |
| claude-2.0 | Defense validity | 52.7%% | Prompt hijacking benchmark / Hijacking#A3.T1; row claude-2.0; column Defense validity; condition Hijacking |
| Llama-2-7b-chat-hf | Hijacking robustness rate | 66.1%% | Prompt hijacking benchmark / Hijacking#A3.T1; row Llama-2-7b-chat-hf; column Hijacking robustness rate; condition Hijacking |
| Llama-2-7b-chat-hf | Defense validity | 19.1%% | Prompt hijacking benchmark / Hijacking#A3.T1; row Llama-2-7b-chat-hf; column Defense validity; condition Hijacking |
| Llama-2-13b-chat-hf | Hijacking robustness rate | 49.4%% | Prompt hijacking benchmark / Hijacking#A3.T1; row Llama-2-13b-chat-hf; column Hijacking robustness rate; condition Hijacking |
| Llama-2-13b-chat-hf | Defense validity | 27.2%% | Prompt hijacking benchmark / Hijacking#A3.T1; row Llama-2-13b-chat-hf; column Defense validity; condition Hijacking |
| Llama-2-70b-chat-hf | Hijacking robustness rate | 50.1%% | Prompt hijacking benchmark / Hijacking#A3.T1; row Llama-2-70b-chat-hf; column Hijacking robustness rate; condition Hijacking |
| Llama-2-70b-chat-hf | Defense validity | 45.4%% | Prompt hijacking benchmark / Hijacking#A3.T1; row Llama-2-70b-chat-hf; column Defense validity; condition Hijacking |
| CodeLlama-34b-Instruct-hf | Hijacking robustness rate | 41.1%% | Prompt hijacking benchmark / Hijacking#A3.T1; row CodeLlama-34b-Instruct-hf; column Hijacking robustness rate; condition Hijacking |
| CodeLlama-34b-Instruct-hf | Defense validity | 63.7%% | Prompt hijacking benchmark / Hijacking#A3.T1; row CodeLlama-34b-Instruct-hf; column Defense validity; condition Hijacking |
| gpt-3.5-turbo-0613 | Exact extraction robustness rate | 12.3%% | Prompt extraction benchmark / Extraction#A3.T2; row gpt-3.5-turbo-0613; column Exact extraction robustness rate; condition Extraction |
| gpt-3.5-turbo-0613 | Defense validity | 91.1%% | Prompt extraction benchmark / Extraction#A3.T2; row gpt-3.5-turbo-0613; column Defense validity; condition Extraction |
| claude-instant-1.2 | Exact extraction robustness rate | 42.1%% | Prompt extraction benchmark / Extraction#A3.T2; row claude-instant-1.2; column Exact extraction robustness rate; condition Extraction |
| claude-instant-1.2 | Defense validity | 81.8%% | Prompt extraction benchmark / Extraction#A3.T2; row claude-instant-1.2; column Defense validity; condition Extraction |
| chat-bison@001 | Exact extraction robustness rate | 12.1%% | Prompt extraction benchmark / Extraction#A3.T2; row chat-bison@001; column Exact extraction robustness rate; condition Extraction |
| chat-bison@001 | Defense validity | 89.5%% | Prompt extraction benchmark / Extraction#A3.T2; row chat-bison@001; column Defense validity; condition Extraction |
| gpt-4-0613 | Exact extraction robustness rate | 69.1%% | Prompt extraction benchmark / Extraction#A3.T2; row gpt-4-0613; column Exact extraction robustness rate; condition Extraction |
| gpt-4-0613 | Defense validity | 89.5%% | Prompt extraction benchmark / Extraction#A3.T2; row gpt-4-0613; column Defense validity; condition Extraction |
| claude-2.0 | Exact extraction robustness rate | 50.9%% | Prompt extraction benchmark / Extraction#A3.T2; row claude-2.0; column Exact extraction robustness rate; condition Extraction |
| claude-2.0 | Defense validity | 53.5%% | Prompt extraction benchmark / Extraction#A3.T2; row claude-2.0; column Defense validity; condition Extraction |
| Llama-2-7b-chat-hf | Exact extraction robustness rate | 44.9%% | Prompt extraction benchmark / Extraction#A3.T2; row Llama-2-7b-chat-hf; column Exact extraction robustness rate; condition Extraction |
| Llama-2-7b-chat-hf | Defense validity | 17.4%% | Prompt extraction benchmark / Extraction#A3.T2; row Llama-2-7b-chat-hf; column Defense validity; condition Extraction |
| Llama-2-13b-chat-hf | Exact extraction robustness rate | 30.0%% | Prompt extraction benchmark / Extraction#A3.T2; row Llama-2-13b-chat-hf; column Exact extraction robustness rate; condition Extraction |
| Llama-2-13b-chat-hf | Defense validity | 25.6%% | Prompt extraction benchmark / Extraction#A3.T2; row Llama-2-13b-chat-hf; column Defense validity; condition Extraction |
| Llama-2-70b-chat-hf | Exact extraction robustness rate | 18.1%% | Prompt extraction benchmark / Extraction#A3.T2; row Llama-2-70b-chat-hf; column Exact extraction robustness rate; condition Extraction |
| Llama-2-70b-chat-hf | Defense validity | 51.6%% | Prompt extraction benchmark / Extraction#A3.T2; row Llama-2-70b-chat-hf; column Defense validity; condition Extraction |
| CodeLlama-34b-Instruct-hf | Exact extraction robustness rate | 33.3%% | Prompt extraction benchmark / Extraction#A3.T2; row CodeLlama-34b-Instruct-hf; column Exact extraction robustness rate; condition Extraction |
| CodeLlama-34b-Instruct-hf | Defense validity | 69.6%% | Prompt extraction benchmark / Extraction#A3.T2; row CodeLlama-34b-Instruct-hf; column Defense validity; condition Extraction |
| gpt-4-0613 | Accuracy | 90.9%% | Zero-shot prompt extraction detection / Accuracy#A4.T4; row gpt-4-0613; column Accuracy; condition Accuracy |
| gpt-4-0613 | Precision | 97.0%% | Zero-shot prompt extraction detection / Precision#A4.T4; row gpt-4-0613; column Precision; condition Precision |
| gpt-4-0613 | Recall | 84.3%% | Zero-shot prompt extraction detection / Recall#A4.T4; row gpt-4-0613; column Recall; condition Recall |
| gpt-3.5-turbo-0613 | Accuracy | 56.5%% | Zero-shot prompt extraction detection / Accuracy#A4.T4; row gpt-3.5-turbo-0613; column Accuracy; condition Accuracy |
| gpt-3.5-turbo-0613 | Precision | 100.0%% | Zero-shot prompt extraction detection / Precision#A4.T4; row gpt-3.5-turbo-0613; column Precision; condition Precision |
| gpt-3.5-turbo-0613 | Recall | 13.0%% | Zero-shot prompt extraction detection / Recall#A4.T4; row gpt-3.5-turbo-0613; column Recall; condition Recall |
Reading scope & review
Selected original HTML sections and table context; not a complete paper/appendix audit or independent reproduction.
Model-assisted reading; independent evidence review pending.
Check the original source ↗